Extracted

• • Target

    pic‮gnp.exe

  • Size

    1.8MB

  • MD5

    e30a5cc72349c1490b3fba6bf260005d

  • SHA1

    c443332dccb17d88a5beb3aa8928f3eb648a59db

  • SHA256

    276b0ad2d3b9d014182403a3fcc6462780a762574baf87e42b72a27e37e41f19

  • SHA512

    b4993be2c6293c17b85f08d6010758a1f137b2b302e959e9316c0592ee5b49e871d5ca9818c28a5136b603cdcb34adfc0cb2cd566c86405ae7d3360d659f25b7

  • SSDEEP

    49152:WIQOOw+fChc0QhOt3e2uhOkVCtwgnrk+J4ClUvFllSL:W8ONKhc0Qqe2uhOkVmrpJ4aWSL

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2